CVE-2026-23741

CVE-2026-23741 describes a critical arbitrary code execution vulnerability in Sangoma Asterisk and Certified Asterisk versions prior to 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2. An attacker with write permissions to the /etc/asterisk/ast_debug_tools.conf file can inject malicious bash code. This code would then be executed with root privileges when the ast_coredumper script runs, as it sources the configuration file. The vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability compromise. It is network-exploitable with low attack complexity and requires low privileges. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal.